Re: An argument AGAINST hosting your own email domain.

From: MTBoxTech (terry_at_removethis.mtboxcomputers.com)
Date: 12/06/04


Date: Mon, 6 Dec 2004 08:48:52 -0500

One of the basic problems here is service. I've got a situation now where
the ISP for a client is currently hosting their email and we are bringing it
in via POP3 connectors. The problem is mail is getting filtered and not
delivered. In this particular case, the client should be receiving
important equipment updates via a weekly newsletter, but it is getting
filtered. What's worse, the ISP doesn't understand their filtering
technology well enough (or doesn't watch the quarantine well enough) to
allow the good mail through.

It's enough of a problem that this client has asked us to bring their email
in-house. I guess my two-cents worth is that properly managed, control over
your email (or that of your clients) is worth the minimal risk. Proper
policies, firewalls, spam filters, and AV filters (which most should be in
place anyway) will greatly reduce the chance of problems.

-TK
M/T Box Computers

"SuperGumby [SBS MVP]" <not@your.nellie> wrote in message
news:uQIZwL42EHA.3408@tk2msftngp13.phx.gbl...
> but you're allowed to argue the 'for'.
>
> My thoughts on this go back a few months when I was asking a client's web
> and zone host to give us an MX record. The support guy I was talking to
> thought I was crazy. 'Mick, we'll host unlimited (users and size)
> mailboxes for them, optionally SPAM check them, AV them, and give them a
> web interface which includes out of office and forwarding capabilities, AT
> NO (additional) COST'.
>
> It's been chewing away at me since. Just why the hey should I open my
> system to 'auth attacks', NDR attacks, attacks which have yet to be
> invented, or even attacks which don't exist, when these guys will throw it
> in with a basic hosting facility?
>
> In the past we didn't like the 'POP Connector', there was a problem where
> it lost mail for the 16th user (7th and 15th users maybe? some number
> user). We still don't like the POP Connector because it doesn't handle
> mail in a global mailbox with multiple 'TO:' fields and also doesn't
> handle 'BCC:' well. BIG DEAL, get rid of your global mailboxes and set up
> individual mailboxes at your hosting company. The hosting company will
> properly 'fan out' the multiple 'TO:' and 'BCC:' mail and as the SBS2003
> dev team fixed the '7th or 15th user problem' the POP Connector's ability
> to collect mail from an individual mailbox and assign it to an Exchange
> mailbox works, we seem to have an ideal situation.
>
> We commonly tell people 'get your WWW hosted', mainly because this means
> we reduce our attack surface by not requiring an open port 80.
> If we also tell them 'let your WWW host also host your email domain' we
> can close port 25, reducing our attack surface further.
>
> We can still pull the mail into Exchange, AV and SPAM check it before it
> gets to the user, give them our own web interface via OWA, bells whistles,
> full kit and kaboodle.
>
> imterested in your thoughts.
> TIA
> mm
>



Relevant Pages

  • Re: An argument AGAINST hosting your own email domain.
    ... clients to be profitable and then you get free hosting. ... > system to 'auth attacks', NDR attacks, attacks which have yet to be ... get rid of your global mailboxes and set up ...
    (microsoft.public.windows.server.sbs)
  • Re: Pen-Test and Social Engineering
    ... (Real hackers will not care if they shutdown or DOS a server.) ... Time of the attacks. ... I once wardialed a client who ... Audit your website security with Acunetix Web Vulnerability Scanner: ...
    (Pen-Test)
  • Re: Mulberry gone, now what?
    ... but do you really want to thread 100K messages from a mobile client? ... Polymer already handles 100K message mailboxes perfectly well ... Polymer gets regularly tested against a mailbox with nearly 130,000 ...
    (comp.mail.imap)
  • Re: Webservice Security
    ... internal attacks are more common than external apps. ... I always start web-service design under the premise that the protocol ... genuine client to find out. ... There are other scenarios relating to external attacks, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Client DDoS requests, ideas?
    ... This wasn't a question specific to any client. ... protocol & app attacks either weren't effective or the ... We're talking straight pipe vs. pipe DoS options. ... A mail server that uses spf could be attacked by creating HUGE spf ...
    (Pen-Test)